Page 1 of 3 123 LastLast
Results 1 to 10 of 21

Thread: Spam problem on a new installation

  1. 07-17-2009, 12:34 AM #1
    SamTzu's Avatar
    SamTzu
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    82
    Rep Power
    8

    Default Spam problem on a new installation

    I just installed a new Zimbra (.18) for testing purposes on a branch office internal LAN network behind a firewall. I then opened a hole on the firewall on port 25 to test the installation. It worked. Today I find that lots of spam has been sent from that server (from yahoo.com.tw address mostly) even though It's only a day old and there has not been a mail server at that IP address previously. How is that possible? What can I do to block the hole?

    The mail server has the same name in DNS and host file.
    The mail server Internal network address is 10.10.x.y
    The mail server External network address is 217.25.x.y
    Firewall has NIC's & addresses on both networks.



    PS. The Joomla based PHP mailing component that I tested uses SMTP authentication with username and password.
    How can I see if the spam has come that way?
    Last edited by SamTzu; 07-17-2009 at 12:43 AM.
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"
    Reply With Quote Reply With Quote
  2. 07-17-2009, 12:40 AM #2
    phoenix
    phoenix is online now Zimbra Consultant & Moderator
    Join Date
    Sep 2005
    Location
    Vannes, France
    Posts
    21,875
    Rep Power
    51

    Default

    How do you determine that spam has been sent from that server? Are there any local Windows PCs on that LAN? Have you checked the logs to see who has connected o that server?

    Opening port 25 in the firewall will not let anyone use that as a relay, by default Zimbra is not an open relay unless you've modified it to be one. Use a web 'open relay' checking service to see if your server is open.
    Regards


    Bill
    Reply With Quote Reply With Quote
  3. 07-17-2009, 12:50 AM #3
    SamTzu's Avatar
    SamTzu
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    82
    Rep Power
    8

    Default

    There was over a 1500 mails in deferred que. (Mostly from that yahoo.com.tw address.)
    (Message count actually showed 250 k but I'm not sure that's accurate.)
    (Spam count for the same time shows 8.0 k.)

    It's a Linux only network.

    Still debugging and checking the logs.

    PS. How do you clear the mail que in Zimbra from command line?
    Last edited by SamTzu; 07-17-2009 at 01:05 AM.
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"
    Reply With Quote Reply With Quote
  4. 07-17-2009, 01:04 AM #4
    uxbod's Avatar
    uxbod
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    7,980
    Rep Power
    22

    Default

    Code:
    su - zimbra
postsuper -d ALL
    That will delete everything in the mail queue. So onto why it may have allowed SPAMs to be sent. You can check whether you are a open relay using Mail relay testing. If it says its open then I would imagine it is down to the networks you have specified for Postfix so please post the following
    Code:
    su - zimbra
zmprov gs `zmhostname` zimbraMtaMyNetworks
    Reply With Quote Reply With Quote
  5. 07-17-2009, 01:09 AM #5
    SamTzu's Avatar
    SamTzu
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    82
    Rep Power
    8

    Default

    Here is sample from the log files...

    Jul 17 09:32:43 zimbra-list1 amavis[6437]: (06437-01) ESMTP::10024 /opt/zimbra/data/amavisd/tmp/amavis-20090717T093243-06437: <Brian_Maria652@ms9.hinet.net> -> <graces89@yahoo.com.tw>,<gracesaly@yahoo.com.tw>,< gracesasa2000@yahoo.com.tw>,<graceschoolther@yahoo .com.tw>,<gracescop@yahoo.com.tw>,<gracesctsao@yah oo.com.tw>,<gracescully@yahoo.com.tw>,<graceself@y ahoo.com.tw>,<gracesgw1216@yahoo.com.tw>,<gracesh2 002@yahoo.com.tw>,<gracesh888@yahoo.com.tw>,<grace shan63@yahoo.com.tw>,<graceshaw@yahoo.com.tw>,<gra ceshe1101@yahoo.com.tw>,<graceshea0317@yahoo.com.t w>,<graceshen_0706@yahoo.com.tw> SIZE=952 BODY=8BITMIME Received: from zimbra-list1.our-domain.com ([127.0.0.1]) by localhost (zimbra-list1.our-domain.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP; Fri, 17 Jul 2009 09:32:43 +0300 (EEST)
    Jul 17 09:32:43 zimbra-list1 amavis[6437]: (06437-01) Checking: xNLJU7+LUmOY [10.10.11.1] <Brian_Maria652@ms9.hinet.net> -> <graces89@yahoo.com.tw>,<gracesaly@yahoo.com.tw>,< gracesasa2000@yahoo.com.tw>,<graceschoolther@yahoo .com.tw>,<gracescop@yahoo.com.tw>,<gracesctsao@yah oo.com.tw>,<gracescully@yahoo.com.tw>,<graceself@y ahoo.com.tw>,<gracesgw1216@yahoo.com.tw>,<gracesh2 002@yahoo.com.tw>,<gracesh888@yahoo.com.tw>,<grace shan63@yahoo.com.tw>,<graceshaw@yahoo.com.tw>,<gra ceshe1101@yahoo.com.tw>,<graceshea0317@yahoo.com.t w>,<graceshen_0706@yahoo.com.tw>
    Jul 17 09:32:46 zimbra-list1 amavis[6437]: (06437-01) Blocked SPAM, LOCAL [10.10.11.1] [10.10.11.1] <Brian_Maria652@ms9.hinet.net> -> <graces89@yahoo.com.tw>,<gracesaly@yahoo.com.tw>,< gracesasa2000@yahoo.com.tw>,<graceschoolther@yahoo .com.tw>,<gracescop@yahoo.com.tw>,<gracesctsao@yah oo.com.tw>,<gracescully@yahoo.com.tw>,<graceself@y ahoo.com.tw>,<gracesgw1216@yahoo.com.tw>,<gracesh2 002@yahoo.com.tw>,<gracesh888@yahoo.com.tw>,<grace shan63@yahoo.com.tw>,<graceshaw@yahoo.com.tw>,<gra ceshe1101@yahoo.com.tw>,<graceshea0317@yahoo.com.t w>,<graceshen_0706@yahoo.com.tw>, Message-ID: <e5920591a7d6e3937648f4290273ebf4@localhost.locald omain>, mail_id: xNLJU7+LUmOY, Hits: 18.773, size: 952, 3675 ms
    Jul 17 09:32:46 zimbra-list1 amavis[6437]: (06437-01) extra modules loaded: /opt/zimbra/zimbramon/lib/i486-linux-gnu-thread-multi/auto/Net/SSLeay/autosplit.ix, /opt/zimbra/zimbramon/lib/i486-linux-gnu-thread-multi/auto/Net/SSLeay/randomize.al, IO/Socket/SSL.pm, Net/LDAP/Extension.pm, Net/SSLeay.pm
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"
    Reply With Quote Reply With Quote
  6. 07-17-2009, 01:11 AM #6
    SamTzu's Avatar
    SamTzu
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    82
    Rep Power
    8

    Default

    Looks normal.

    root@zimbra-list1:/var/log# su zimbra
    zimbra@zimbra-list1:/var/log$ zmprov gs `zmhostname` zimbraMtaMyNetworks
    # name zimbra-list1.our-domain.com
    zimbraMtaMyNetworks: 127.0.0.0/8 10.10.11.0/24
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"
    Reply With Quote Reply With Quote
  7. 07-17-2009, 01:12 AM #7
    uxbod's Avatar
    uxbod
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    7,980
    Rep Power
    22

    Default

    Well check if your server is a open relay and if not it maybe that a account has been compromised so also check /opt/zimbra/log/audit.log for any erroneous account activity.
    Reply With Quote Reply With Quote
  8. 07-17-2009, 01:15 AM #8
    SamTzu's Avatar
    SamTzu
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    82
    Rep Power
    8

    Default

    I actually tried that...

    su - zimbra
    postsuper -d ALL
    postsuper: fatal: use of this command is reserved for the superuser
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"
    Reply With Quote Reply With Quote
  9. 07-17-2009, 01:19 AM #9
    uxbod's Avatar
    uxbod
    uxbod is offline Moderator
    Join Date
    Nov 2006
    Location
    UK
    Posts
    7,980
    Rep Power
    22

    Default

    Oops As root
    Code:
    /opt/zimbra/postfix/sbin/postsuper -c /opt/zimbra/postfix/conf -d ALL
    Reply With Quote Reply With Quote
  10. 07-17-2009, 01:22 AM #10
    SamTzu's Avatar
    SamTzu
    SamTzu is offline Loyal Member
    Join Date
    Jan 2006
    Location
    Finland
    Posts
    82
    Rep Power
    8

    Default

    Much better, thx.
    SamTzu
    -----------------------------------------------
    "I keep hitting the esc key, why am I still here?"
    Reply With Quote Reply With Quote
Page 1 of 3 123 LastLast
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Similar Threads

  1. [SOLVED] Close to despair: LDAP installation problem!?
    By Xeronimo1974 in forum Installation
    Replies: 4
    Last Post: 07-17-2009, 09:10 AM
  2. problem with the installation of zimbraLdap replica
    By jnimo in forum Installation
    Replies: 7
    Last Post: 01-20-2009, 11:48 PM
  3. [SOLVED] Problem with ldap on installation zimbra
    By yuranchik in forum Installation
    Replies: 1
    Last Post: 12-12-2007, 01:51 AM
  4. Debian installation of 4.5.10 with logger problem
    By firefox32 in forum Installation
    Replies: 3
    Last Post: 11-30-2007, 05:28 AM
  5. Installation succesfful! But problem with zmcontrol start
    By mansuper in forum Installation
    Replies: 16
    Last Post: 09-07-2006, 06:39 AM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules